Network Security, Patch/Configuration Management, Vulnerability Management

Apple issues iTunes update to close man-in-the-middle hole

Apple on Monday released an updated version of its iTunes program to close a vulnerability that could lead to a man-in-the-middle attack. Version 10.5.1 contains a fix for a flaw that could permit an attacker to "offer software that appears to originate from Apple" when users are prompted to install an iTunes update but don't have Software Update for Windows installed, according to an advisory. "[C]licking the 'Download iTunes' button may open the URL from the HTTP response in the user's default browser," the advisory said, at which time an attacker theoretically could pass malicious content to the user.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.